There are quite a lot of things into this. You might have boundaries, such as:
1) declared boundaries
2) misdeclared boundaries
3) boundaries that affect performance/UI/security
4) language/framework/OS/hardware set boundaries
5) input/output boundaries
6) unknown boundaries (e.g. part of code we didn’t know that exists)
Finding these kind of boundaries is often done either by exploring input and outputs, or revving up tools that are meant to do this. The oversimplified focus to test declared boundaries is limiting the imagination of the tester. Similar with the claim “most bugs happen at boundaries”, which is partially because we focus so much effort on testing those (declared) boundaries. I’m not saying we should not test declared boundaries, but that we should open our minds for other kind of boundaries – and testing.
EDIT: I almost forgot to add this BVA mindmap from TestInsane, the most insane testing company in the world!